Forum Discussion

rianjs's avatar
rianjs
New Contributor
20 days ago

Bug: Secure Note silently URL-encodes non-pretty JSON content between detected URLs

Reproduction:

  1. Create a new Secure Note.
  2. Paste a JSON blob that contains two or more URLs separated by other JSON content. For example, a Google OAuth credentials.json file, make sure it's not the "pretty" version
  3. Save the note
  4. Copy the note contents back out

Here's a specific case:

{"installed":{"client_id":"the-client-id","project_id":"the-project-id","auth_uri":"https://accounts.google.com/o/oauth2/auth","token_uri":"https://oauth2.googleapis.com/token","auth_provider_x509_cert_url":"https://www.googleapis.com/oauth2/v1/certs","client_secret":"the-secret","redirect_uris":["http://localhost"]}}

Yields:

Interestingly, the "pretty" version of the JSON round-trips just fine, though it looks weird in the 1Password UI:

{
  "installed": {
    "client_id": "the-client-id",
    "project_id": "the-project-id",
    "auth_uri": "https://accounts.google.com/o/oauth2/auth",
    "token_uri": "https://oauth2.googleapis.com/token",
    "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
    "client_secret": "the-secret",
    "redirect_uris": [
      "http://localhost"
    ]
  }
}

Yields:

Version:

 

No RepliesBe the first to reply